Threats tagged 'ghsa-9f4m-7955-grcm'

The Flatsome WordPress theme up to version 3.20.12 is vulnerable to stored cross-site scripting (XSS) via insufficient sanitization of certain HTML attributes ('data-text-sec', 'data-title', and 'title') in custom HTML blocks. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because WordPress's wp_kses_post function allows global data-* attributes, enabling attacker-controlled values to persist and be interpreted as executable HTML by specific JavaScript behaviors in the theme.